Act in this order: use a trusted device and the provider’s official recovery process, contact the email administrator or provider, change the password, revoke existing sessions, enable multi-factor authentication, remove unauthorized recovery methods and mailbox rules, investigate sent and deleted mail, secure related accounts, warn people who may have been targeted, and assess reporting duties. A password change by itself may leave an attacker signed in through an existing session, forwarding rule, application authorization, or altered recovery method.
1. Contain the account through a trusted path
Do not use a recovery link from an unexpected email, chat message, or search advertisement. Open the provider’s website by typing its known address or use a bookmark maintained by your business. If the computer or phone used for recovery may be infected, use a known-good device instead.
As an Amazon Associate I earn from qualifying purchases.
- Contact the provider or administrator. Tell the person who administers your business email what happened. For a hosted business platform, an administrator may be able to suspend the user, revoke sessions, inspect audit records, and reset access. If the administrator account, recovery mailbox, phone number, domain registrar, or DNS account may also be compromised, treat those dependencies as part of the incident and contact each service through its official support channel.
- Change the compromised password. Set a long, unique password that has not been used for any other service. Do this from the trusted device and do not save it in a browser profile that other people can access.
- Revoke active sessions. Use the provider’s security page or administrator console to sign out other browsers, phones, and applications. Microsoft’s guidance for a compromised Microsoft 365 user includes revoking sessions and invalidating refresh tokens; the label and location differ with other providers.
- Turn on multi-factor authentication. Register only methods and devices that the business recognizes. If the provider supports a FIDO2-compatible hardware security key, it can be considered as a phishing-resistant option, but it is not a substitute for recovering the account first.
If you cannot regain control, stop trying random “account recovery” services. Give the provider’s official support team the account identifier, administrator details, approximate time of compromise, and proof of business ownership that it requests. Keep a record of case numbers and communications.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Remove ways the intruder can come back
Attackers often preserve access outside the password. Check every setting below in the mailbox and, where applicable, in the organization’s administrator console.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Forwarding and inbox rules
Delete forwarding addresses you do not recognize. Review rules that automatically forward, delete, hide, mark as read, or move messages—especially rules matching words such as “invoice,” “payment,” “wire,” “password,” or “security.” A malicious rule can keep hiding evidence after the password has been changed.
Recovery information and MFA registrations
Verify recovery email addresses and phone numbers character by character. Remove unfamiliar authenticator registrations, security keys, backup codes, or remembered devices, then enroll the business-approved methods again. If the attacker changed the recovery information, use the provider’s documented administrator or support process rather than trying to overwrite it repeatedly.
Connected applications and delegated access
Inspect applications that have permission to read mail, send mail, manage contacts, or access files. Revoke consent for anything the business did not approve. Also check mailbox delegation and shared-mailbox permissions; an intruder may have granted another account access without changing the mailbox password.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSessions, tokens, and other identities
Look for unfamiliar browsers, mobile devices, locations, or active sessions. In Microsoft 365, an administrator should follow Microsoft’s current compromise-response procedure for session revocation and token invalidation. Other providers use different controls, so do not assume that a global sign-out has occurred unless the provider confirms it.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Reconstruct what happened before deleting evidence
Investigation should happen after containment steps that stop ongoing access, but before you erase useful records. Export or preserve relevant messages, timestamps, sign-in records, audit events, rule settings, and provider support correspondence in a restricted location.
Review mailbox artifacts
- Read the Sent folder for messages the attacker sent, including replies in legitimate conversations.
- Check Deleted, archive, junk, and quarantine folders for messages that may have been read or removed.
- Search for changed payment instructions, fake invoices, password-reset requests, shipping changes, and requests for confidential files.
- Compare forwarding, filtering, delegation, and automatic-reply settings with a known-good configuration.
Use available sign-in and audit records
Record dates, IP addresses or locations shown by the provider, device types, successful and failed sign-ins, administrative changes, application consent, and token or session events. These records can be incomplete or retained for different periods, so save them promptly. Do not describe a location as proof of a person’s identity; it is an investigation clue.
Classify the exposed information
List conversations and attachments involving payroll, banking, customer or employee personal information, contracts, credentials, intellectual property, and domain administration. This list determines which accounts and people need follow-up and helps legal or incident-response advisers evaluate notification duties.
4. Check the device used to access email
An attacker may have stolen a password through malware, a fake sign-in page, a malicious browser extension, or an unmanaged device. If the computer or phone behaves unusually, or if compromise of the device is plausible, update its existing security software and run a full scan. Remove software the scan identifies as suspicious and restart the device, following the security product’s instructions.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not assume that buying a particular cleanup utility is required. The essential steps are to use a clean device for recovery, apply available security updates, scan when infection is possible, and obtain qualified technical help if the device cannot be trusted.
5. Protect accounts that depend on this mailbox
Email access can expose password-reset links for other services. Make an inventory of accounts that use the compromised address for login, recovery, notifications, or administrator contact.
| Priority | Accounts to examine | What to look for |
|---|---|---|
| Immediate | Banking, payment, payroll, and accounting | Unexpected password resets, new payees, changed bank details, altered approval rules, or suspicious transactions |
| High | Cloud storage, customer systems, password managers, and collaboration tools | New sessions, API keys, delegated users, downloaded data, or changed recovery details |
| High | Domain registrar, DNS, website hosting, and email administration | Changed nameservers, DNS records, administrator accounts, forwarding, or mail-routing changes |
| As indicated | Other services using the address for recovery | Password-reset messages or access activity during the compromise period |
Use each service’s official website, not a link in the mailbox, to change credentials or challenge suspicious transactions. If a financial instruction may have been altered, call the institution using a phone number already on file or printed on a trusted statement.
Recommended Free Tools
6. Warn employees, customers, and business partners safely
Internal instructions
Tell employees through a channel that was not dependent on the compromised mailbox, such as a known telephone number, in-person briefing, or separately verified messaging system. Explain the date range under investigation, what suspicious messages may look like, and where staff should report them. Instruct employees not to open attachments, follow password-reset links, or rely on a new payment instruction merely because it appears in an existing email thread.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Payment and wire-transfer verification
Require independent verification for wire transfers, payroll changes, vendor bank details, gift-card requests, and urgent requests for secrecy. Use a previously trusted phone number or another established channel; never use the contact details supplied in the suspicious message.
Customer and vendor notices
Contact customers, vendors, or financial institutions when evidence shows that they received fraudulent instructions, were impersonated, or had information exposed. A notice sent by email should avoid links that could make it resemble phishing. Give recipients a known website address or telephone route that they can enter or find independently. Explain what the business knows, what it is doing, and how recipients can verify a legitimate request.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Decide whether to involve specialists or report the incident
Bring in qualified IT or security support when the business lacks administrator expertise, when more than one account is affected, or when the incident involves malware, domain control, fraud, or large amounts of sensitive data. Notify a cyber-insurance carrier according to the policy’s conditions before engaging services that the insurer requires to approve.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Preserve evidence and consider law-enforcement contact when there is financial theft, extortion, identity fraud, or a credible threat to people or systems. The Federal Trade Commission’s Data Breach Response: A Guide for Business advises businesses to “Move quickly to secure your systems and fix vulnerabilities that may have caused the breach.”
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Assess notification duties by context
There is no universal deadline established for an unspecified business. Requirements depend on the business’s location, the people affected, the types of personal information involved, industry rules, contracts, and whether systems outside the mailbox were accessed. Identify the relevant jurisdictions and regulators before promising a notice date. U.S.-focused FTC guidance recommends notifying law enforcement, affected businesses, and affected people as appropriate; it is not a legal determination for every country or sector.
Ask legal counsel or a qualified breach-response adviser to document the facts, determine whether personal information was exposed, and decide which notices are required. Keep the investigation factual: distinguish confirmed access from messages that were merely present in the mailbox and from activity that remains unknown.
8. Strengthen the mailbox and business domain after recovery
Make MFA an operating requirement
Require MFA for email, administrator accounts, remote access, financial systems, and other high-value services. Keep recovery methods current and store backup codes under controlled access. A hardware token is one MFA option identified in FTC guidance; confirm that the provider supports the specific key and establish a recovery process before making it the only method.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Limit administrator exposure
Use separate administrator identities, least-privilege roles, and a documented process for adding or removing mailbox delegates and connected applications. Review these permissions periodically rather than waiting for an incident.
Authenticate messages sent from your domain
For a business using its own domain, ask the email host or domain administrator to review SPF, DKIM, and DMARC. These mechanisms help receiving servers verify that a message claiming to come from the business was authorized. They can reduce domain spoofing, but they do not remove an intruder from a mailbox, undo malicious forwarding, or clean an infected device.
Set verification policies
Write down how staff verify payment changes, payroll instructions, password resets, and urgent requests for confidential data. Train new employees on the policy and test that the alternate contact numbers and approval paths still work.
Quick Recap
Common mistakes that prolong an email compromise
- Changing only the password: active sessions, refresh tokens, forwarding rules, application consent, and altered recovery methods may remain.
- Investigating from the suspect device: malware or a hostile browser extension can capture the new password.
- Trusting a message that appears in a familiar thread: the attacker may have inserted it after reading earlier correspondence.
- Deleting everything immediately: lost messages and logs can make fraud analysis and notification decisions harder.
- Announcing the incident through the compromised mailbox: recipients may receive a second fraudulent message or click a link in a notice that looks like phishing.
- Assuming SPF, DKIM, or DMARC repairs the account: domain authentication addresses spoofing, not mailbox takeover.
A practical handoff checklist
- Trusted device selected and provider reached through an official route
- Password changed and active sessions or tokens revoked
- MFA, recovery addresses, phone numbers, and registered devices verified
- Forwarding, inbox rules, delegation, and connected applications reviewed
- Sent, deleted, archive, and junk folders examined
- Sign-in and administrative records preserved
- Device updated and scanned when infection is possible
- Financial, payroll, cloud, domain, and customer accounts assessed
- Employees and affected contacts warned through trusted channels
- IT, insurer, legal counsel, regulators, or law enforcement engaged as the facts require
- Organization-wide MFA, least privilege, verification policies, and domain authentication planned
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
